9456667afa - platform/frameworks/av

commit: 9456667afa012cfa93619337839e48abcc5b9842
[log]
author: Venkatarama Avadhani <venkataramaa@google.com>
Wed May 20 11:56:27 2026 +0530
committer: Android Build Coastguard Worker <android-build-coastguard-worker@google.com>
Fri Jul 10 08:22:42 2026 -0700
tree: e1a7187a9989563d67ee97e3fbbdc694b87c500d
parent: 9b0bc5f798529f93f01d208c87d15b447b60d114 [diff]

Fix signed overflow in convertCleanApertureToRect

In HeifCleanAperture.cpp:convertCleanApertureToRect(),
centerX.getInt32() and centerY.getInt32() are added with clapW and
clapH respectively to calculate the right and bottom coordinates.
This signed-integer addition can overflow int32_t with maliciously
crafted CleanAperture values, causing an IntSan abort in the
media.extractor process.

Prevent the overflow by validating bounds using safe int64_t arithmetic
prior to performing the addition.

Bug: 503550257
Test: atest HeifCleanApertureUnitTest --host
Flag: EXEMPT BUGFIX
Cherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:5fcd67a562a2dffdfaf25f35c7acf805a96ac8ae
Cherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:4ee19decff042654c08cd62ece8cc8e0de15d06f
Merged-In: I2b282fc9e69a6510e9414fd2bbfe3beddf81001e
Change-Id: I2b282fc9e69a6510e9414fd2bbfe3beddf81001e

2 files changed

tree: e1a7187a9989563d67ee97e3fbbdc694b87c500d